Introduces a rework of the Passkey fetching system inside the Library, where instead of relying to the FIDO2 API, it uses the Credential Manager. This will allow us to properly support Passkeys provided by third-party security services, like 1Password.
To make this test scenario possible, make sure you have the following:
A WordPress.com account configured with Security key authentication.
An operational 1Password account.
An Android 14 device, emulators won't work, it must be a physical Android 14 device.
A second device, Android or iOS, different from the Android 14 one mentioned in requirement 3.
Scenario 1 - Login with locally installed Passkey
Open your Android device browser and access WordPress.com.
Go to your Security settings and create a Security Key in your account using the device browser.
Open the Woo app configured with this PR and start the login flow with the same WordPress.com account you used to create the Security Key.
Once you hit the 2FA screen, make sure the Use security key button appears and click on it.
Make sure the Credential Manager opens up with a selectable Passkey and select it.
Verify that the login flow continues and succeeds.
Scenario 2 - Login with Passkey provided by 1Password
Open your Mac browser and access WordPress.com in a browser containing the 1Password extension installed.
Go to your Security settings and create a Security Key in your account using 1Password.
Open the Woo app configured with this PR and start the login flow with the same WordPress.com account you used to create the Security Key.
Once you hit the 2FA screen, make sure the Use security key button appears and click on it.
Make sure the Credential Manager opens up with a selectable 1Password passkey option.
Verify that the login flow continues and succeeds.
Scenario 3 - Login with Passkey provided by another device
Take a device different from the Android 14 one you used in Scenario 1.
Open this second device browser and access WordPress.com.
Go to your Security settings and create a Security Key in your account using the device browser.
Open the Woo app configured with this PR with the Android 14 device and start the login flow with the same WordPress.com account you used to create the Security Key.
Once you hit the 2FA screen, make sure the Use security key button appears and click on it.
Once the Credential Manager opens up, select the Sign-in optionsand select thelogin with another device` option.
Make sure a QR Code appears.
Read this QR code with your SECONDARY device you used in step 1 to create a Passkey.
Verify that both devices connects with each other and the Passkey is used from the Secondary device to the Android 14 one.
Verify that the login flow continues and succeeds.
Update release notes:
[x] I have considered if this change warrants user-facing release notes and have added them to RELEASE-NOTES.txt if necessary.
Summary
Feature branch mapping all changes related to the Credential Manager adoption.
Why
Introduces a rework of the Passkey fetching system inside the Library, where instead of relying to the FIDO2 API, it uses the Credential Manager. This will allow us to properly support Passkeys provided by third-party security services, like 1Password.
Screen capture
https://github.com/wordpress-mobile/WordPress-Login-Flow-Android/assets/5920403/85fd3354-3c09-4529-85ec-9db6e6f6f111
How to Test
⚠️ Pre-requisites
To make this test scenario possible, make sure you have the following:
Scenario 1 - Login with locally installed Passkey
Use security keybutton appears and click on it.Scenario 2 - Login with Passkey provided by 1Password
Use security keybutton appears and click on it.Scenario 3 - Login with Passkey provided by another device
Use security keybutton appears and click on it.and select thelogin with another device` option.Update release notes:
RELEASE-NOTES.txtif necessary.